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The "semiquantum" key distribution protocol introduced by Zou et al. is examined. The protocol 
while using two-way quantum communication requires only Bob to be fully quantum. We derive a 
trade-off inequality between information gained by Eve and the disturbance observed by legitimate 
users. It guarantees that Eve cannot obtain large information if the disturbance is sufficiently small. 
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Recently, several "semiquantum" key distribution protocols were proposed [H-IH- In contrast to the common quantum 
key distribution protocols such as BB84, one of the parties in these protocols uses only classical operations. In their 
pioneering work, Boyer, Kenigsberg and Mor introduced[l| a two-way semiquantum key distribution protocol using 
four states. Zou, Qiu, Li, Wu, and Li derived[3j its simplification that requires only one state. These protocols are 
interesting, because they give insights into the necessary conditions for achieving secure communication. In return for 
the merit that the protocols need only one quantum party, they use two-way quantum communication channels. This 
makes the security proof difficult. In fact, only the robustness of the protocols has been proved so far[lj, |2|, |4Hfj|. The 
robustness of the protocols suggests that information gained by Eve inevitably disturbs the communication between 
^ . Alice and Bob. While this robustness is necessary for the security of the protocols, as the no-cloning theorem was in 
the BB84 protocol, the next important step should be taken for showing a quantitative trade-off relationship between 
the information gained by Eve and the disturbance observed by legitimate users 0,3- This type of relationship in the 
' BB84 protocol is called the information-disturbance theorem [9t Il0|. 
^ , In this paper, we derive such a trade-off relationship in the protocol introduced by Zou et aL[3J. In this protocol, 
0^ ' the existence of Eve is noticed by performing two error-checking procedures. The inequality we derive relates the 
, amount of information gained by Eve to these error probabilities. 

<N 

lO '. II. FORMULATION AND RESULTS 

o 

1 I 

A. Formulation 

The protocol given by Zou et al. 3] runs as follows. Bob sends Alice N qubits each in the state |+) := — ^ ( 1 0) + |1)) 
and keeps all qubits he receives back from her in a quantum memory. After confirming the receipt of all qubits by 
Bob, Alice publicly announces which qubits she reflected (without disturbing them); Bob then checks that he received 
|+) and not |— ) := ;4g(|0) — |1)) on those positions (CTRL). For the (SIFT) qubits measured by Alice in the standard 

(classical) {|0), |1)} basis, a sample is chosen to be checked for errors (TEST). The remaining SIFT bits serve for 
obtaining a final key via error correction and privacy amplification. 

Instead of this full protocol, we treat its toy version using a qubit without the public discussion. This protocol 
including Eve's attack is described as follows. We consider two situations: CTRL and SIFT. In both situations, Bob 
first sends a qubit to Alice in the state |+) £ T-L :— C 2 . Eve makes the qubit interact with her apparatus IC by a 
unitary operation V : H <E) IC rl <£) 1C. The whole state evolves into 

|*) :=V\+)®\Sl), 

where |f2) denotes the initial state of Eve's apparatus. 

In the case of CTRL, Alice reflects the qubit without disturbing it. Eve again makes the qubit sent from Alice 
to Bob interact with her apparatus. It is described by a unitary operation U : rl (g> K. — » rl <£> JC. The whole 
state after the interaction is thus described as U\^5>) = UV\+) ® |fi). Bob measures a projection- valued measure 
(PVM) X = {X + ,X_} := {|+)(+| ® lie, |-)H ® 1 K } to check whether the state is in |+). We define P C trl by 
Pctrl ■= (^\U*X-U\^>), which is an error probability in CTRL. 



2 



In the case of SIFT, after receiving a qubit, Alice measures a PVM Z = {Z , Z{\ := {|0)(0| ® ljc, |1)(1| Ik}- 
The probability for obtaining z e {0, 1} is calculated as Pg IFT {z) := (\f , |Z z |\f r ). The state after the measurement is 
changed according to the von Neumann-Liiders postulate. If z is obtained, the whole state becomes 

a Z Z \*)(*\Z Z 
Psift( z ) 

Alice sends the qubit back to Bob. Also in this case, Eve makes the qubit interact with her apparatus by using U. The 
whole system thus becomes Ua z U* . After receiving the qubit, Bob checks the state by measuring Z . The (conditional) 

B I A 

probability for obtaining z' 6 {0, 1} when Alice's outcome is z is represented as Pgjpx 

(z'\z) :=tx(U(j z U*Z z ,). Using 

these quantities, we define an error probability in SIFT by Psift '■— Psift (M®)Psi ft (®) +Psift(^\^)Psift(^)- This 
quantity is represented as Psift = (^\ZqU* Z\U Zq\^) + {^\Z-JJ* ZqU Zi\^) . Eve's purpose is to know the outcome 
obtained by Alice. Let us denote the state possessed by Eve after the two-way quantum communication when Alice 
obtains z in SIFT by p z . It is represented as 

pz ■= tr n (Ua z U*), 

where tr% is the partial trace over %. Eve measures a positive-operator-valued measure (POVM) E — {E e } which 
acts only on K. for extracting information. That is, each E e can be represented as E e = l n (g> E e by using some 

E\ A 

E e . We denote by PsiFr( e \ z ) the probability for obtaining an outcome e when Alice obtains z. It is represented as 

PsiFT( e \ z ) = tr(p z -E e ). We denote by PsFft( z > e ) the joint probability representing the case that Alice obtains z and 

Eve obtains e. This quantity is calculated as Pgf FT {z, e) = Ps\ FT (e\z)pj IFT (z) = {^\Z z U*E e UZ z \^). In addition, 

the probability for obtaining e is calculated as Ps IFT (e) := J2 z PsiFT( e \ z )PsiFT( z )- The information gained by Eve 
is characterized by the mutual information, which is defined by 

I(A : E) = H(A) + H(E) - H(A, E), 

where H(A) := -E z Psift( z )^°S2Psift( z ), h ( e ) ■= - E e Ps ift ( e ) lo g 2 pf ift (e) and H(A,E) := 
— ePsFft( z ^ e ) \°S2P AE ( z i e )- Eve has two chances to make her apparatus interact with the qubit. It is obvi- 
ous that each interaction can help her obtain information. For instance, Eve can have an entangled state between 
her apparatus and the qubit sent to Alice by using V. Although it brings her information, this interaction leaves its 
trace behind by disturbing the state. Our aim in this paper is to derive a trade-off inequality that bounds I(A : E) 
by Pctrl and Psift for general attacks in which both U and V are arbitrary. 



B. Relation between information and disturbance 



The following is our main theorem. 
Theorem 1 The information gained by Eve can be bounded from above as 

I(A:E) < 2^/p CTRL + 6P 1 s / IFT , 
where Psift and Pctrl are the error probabilities defined above. 

This theorem generalizes the robustness result. In fact, if we put Pctrl — Psift — in the above inequality, 
I(A : E) = follows. That is, information gained by Eve inevitably causes disturbance. Moreover, the theorem 
guarantees that information gained by Eve is small if both of the probabilities Pctrl and Psift are sufficiently 
small. 

We employ two lemmas to prove our main theorem. The following lemma is employed to bound the mutual 
information by a quantity that is easier to treat. 

Lemma 1 Let X and Y be random variables. Suppose that X takes a value in {0, 1}. Denote by p XY (x, y) the joint 
probability representing the case that X takes x and Y takes y. The mutual information between X and Y is bounded 
as 



I(X : Y) < 



i 



1 - 4 fep' YV '(°'!<) 1/2 P Xy < 1 '!<> 1/2 ) 
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Proof: The proof is the slightest modification of Theorem 1 in Ref . fllj . Let us denote by p x (x) and p Y (y) 
the marginal probabilities with their apparent notations, and by p x \ Y (x\y) the conditional probability defined by 

p x \ Y (x\y) — V pvfy)^ ■ The mutual information can be written as 

I(X:Y)=H(X)-H(X\Y), 

where H(X) := - ^ x p x (x) log 2 p x (x) and H(X\Y) := -J2 y P Y (y)E x P X{Y ( x \v) lo S2 P X]Y iAv)- Because H(X) < 1 
and -Y,xP XlY ( x \y) l °g2P XlY (x\y) > 2mm{p x \ Y (0\y),p x \ Y (l\y)} hold, it holds that 

i(x : Y) < i - 2Y / p Y (y)^{p xlx (o\y),p xlY (i\y)}- 

y 

Using p x \ Y (0\y) +p xlY (l\y) = 1, we obtain -2 min{p x \ Y (0\y),p x \ Y (l\y)} = -1 + \p xlY (0\y) -p xlY (l\y)\. Thus it 
holds that 

i(x : y) < Y,p Y (y) \p xlY (o\y) - p xlY m\ = £ \p XY (°>y) ~ p XY (^y)\ ■ 

y y 
The right-hand side of this inequality can be bounded as follows: 

^2\p XY (0,y)-p XY (l,y)\ 



£ ^p XY (0,y)-^ P XY (l,y) v /^(0,y) + y / p^(l, 2/ ) 



^ [J2(\/p XY (°>y)-VP XY ( 1 >y)) E v^(°'f) + v^ 1 '») 



1/2 



1/2 



i - 2 £^(o, y) v V y (i, y) 1/2 ) (i + 2 £ P ^(o, y) v V y (i, y) 1/2 ) 

v y / \ y / 

where we used the Cauchy-Schwarz inequality. ■ 

The following lemma plays an important role in relating probabilities in SIFT and CTRL with each other. 

Lemma 2 For any (possibly unnormalized) vectors \4>a), \4>i) & K,, any bounded operator X acting only on %, 
any POVM E — {E e } acting only on 1C, it holds that 



\{<h\x\<h)\ < WxwY^iMEeW 2 ^^) 1 

e 

where || • || is an operator norm defined by \\X\\ := sup^Q ^j^^ • 

1 (1 

Proof: Using the commutativity between EJ and X, we obtain 

\(4> \X\^)\ = |£<0o|*25e|fc>l =\^2(ct>o\El /2 XEl 



/2 



(1) 



/2| 



We further obtain 



\(<h\X\<h)\ < Y,\^o\E 1 J 2 XE^\cb 1 )\ 

e 

e 

< £(0o|Se|0o) 1/2 (0l|S e |0l) 1/2 ||^||, 
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where we used the Cauchy-Schwarz inequality to derive the second line and the definition of the operator norm to 
derive the third line. ■ 

Proof: (Proof of Theorem 1) We apply Lemma[T]to p^f FT {z 1 e) in order to bound I(A : E). To bound PgfpTi z 7 e ) by 
Psift and Pctrl-, we compare this quantity with another probability po(z, e) defined by Pq(z, e) := (^\U* Z z E e U\^f) . 
Using Z z + Z zS) i = 1, we obtain 

uz z = Z z UZ z + Z zS)1 UZ z 

= z z u + c z , 

where C z := Z Z( ^\UZ Z — Z Z \JZ Z ^\. Thus it holds that 

pjf FT (z,e) = (y\(U*Z z + C* z )E e (Z z U + C z )\V) 



p (z,e) + (<f\U*Z z E e C z \V) + (*\C* z Z z E e U\*) + (*|C*^ e C,|^). 



We obtain 



\pj? FT (z,e)- Po (z,e)\ = mU*Z z E e C z \<f) + (9\C*Z x E e U\^) + {^\C* z E e C z \^)\ 
< (y\U*Z z E e U\y) 1/2 (^\C* z E e C z \y) 1/2 + (y\C* z E e C z \y) 1/2 (^\U*Z z E e U\y) 1/2 

+mc* z E e c z \^) 

= 2p {z,e) 1 ' 2 mC* z E e C z \^) 1 ' 2 + ^\C* Z E & C Z \^), 

where we used the triangular inequality and the Cauchy-Schwarz inequality. Because \a— b\ < c implies Iv^ - V&| ^ 
for positive a, b and c, it holds that 

\JpsF FT (z,e)- V»M < (2po(z,e)^ 2 (^\C;E e C z \^ 2 + (^\C* z E e C z m) 1/2 . (2) 

We apply LemmaSto \<f>o) = Z U\V), \<f>i) = Z X U\^) and X = |0)(1| ® 1 K . The left-hand side of © can be bounded 
as 

\{<k\X\<h)\ = \{9\U*(\0){1\®1 K )U\*)\ 

> (*\U'(\0)(1\ ® 1 K )U\V) + (*\U*(\1)(0\ ® IkWW 

2 

= - - (^\U*X-U\^) 

= 2 ~ Pctrl- (3) 

The right-hand side of U]) becomes 

ii*ii Y,^\em 1/2 (^\em^ 2 = E^(°' e ) 1/2 ^( Le ) 1/2 

e e 

1/2 



< E KfFT(Q,e) V2 + (2p (0,e) 1/2 (*|C *£; e Co|vI/> 1 / 2 + (*\C* E e C Q \*) ^ 

e ^ 

• {psFft(^^ 2 + (2p (l, e ) 1 /2(v I /|C 1 *i? e C 1 |*) 1 / 2 + (*|C 1 * J B e C 1 |*)) 1/2 ) , (4) 
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where we used ([2]). By using the Cauchy-Schwarz inequality, we can further bound the above inequality as 
©<E^T(0,e)n4^M) 1/2 

e 

+Psift(0) 1/2 ^(2po(l,e) 1/2 (*|C 1 * J B e C 1 |*) 1 / 2 + (^E^))^ 
+Psift(1) 1/2 ^(2po(0,e) 1/2 (*|C * J B e Co|*) 1 / 2 + <*|C *£ e C |*})) 
+ (^2(2 Po (l,e) 1 / 2 (^\C* 1 E e C 1 \^ 2 + (*|Cf£? e Ci|*))^ 

x ^(2 Po (0,e) 1 / 2 (vI/|C * J B e Co|vI/) 1 / 2 + (*|CS25 e C |*»^ . 

Thetenna£ e (2po(0,e)V2(¥|C*£^ 
are bounded as 

E(2po(0, e ) 1/2 (*|C *i? e Co|*) 1 / 2 + (*|C *£ e C |*)) 

e 

< 2^(0) 1 / 2 (*|C*CoW 1/2 + (* I C * Co |*) 
^(2 Po (l, e ) 1 / 2 (*|Cri? e C 1 |*) 1 / 2 + (^IC^edl*)) 

e 

< 2p 4 (l) 1/2 (*|C 1 *C 1 |^) 1 / 2 + 

where p^ 2 ) := SePoO^, e) and we used the Cauchy-Schwarz inequality and the relation ~}2, e E e — 1/c. Because 
C*C Z = Z z U*Z ml UZ z + Z zm U*Z z UZ zm holds, we have, for z = 0, 1, 



(*|c;c,|*) = p j 



SIFT- 



Thus we obtain 



e e 

+^/ft(0) 1/2 (2po 4 (1) 1/2 ^ 2 ,t + ^W) 1/2 
+^ /FT (l) 1 / 2 (2p o 4 (0) 1/2 P^ T + P S1F t) 1/2 
+ (2p 4 (l) 1/2 P^ T + P s ^t) 1/2 (2po 4 (0) 1/2 P^ t + Psjft) 1 ' 2 . 
< E^T(0,e)V^f irT (l, e) V 2 

e 

+(2rf(l) 1/a J$&T + 2p 4 (0) 1 / 2 P^ T + 2P S/FT ) 1 / 2 
+ \ ( 2 p 4 (l) 1/2 P^ T + 2jtf(0) 1 / 2 Pj& T + 2P S/FT ) , 

where we used the Cauchy-Schwarz inequality again. Because Psift < Psift an d Po (®) ■> Po (^) — 1 hold, it holds 
that 

||X||E(^o|P e |0o) 1/2 (0i|P e |^i) 1/2 

e 

< E^Fft(0, e)^p A s f FT {l, e)^ + V6P^ FT + 3P^ FT 

e 

< E^fFT(0,e) 1 /^f FT (i, e )V2 + 6 pV4 Tj (5) 
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where we used + 3 < 6. (Although the above inequality can be slightly improved, we do not treat it here as it is 
not important.) Thus ([3]), ([5]) and Lemma [5] derive 

e 

Now we can apply Lemma [I] to obtain 

I{A:E) < 2^J (P ctrl + GPsift) ~ ( p ctrl + 6P^ T ) 2 
< 2y ' Pctrl + 6P^ t . 



III. SUMMARY 



In this paper, treating the quantum key distribution protocol with classical Alice, we obtained a trade-off relation- 
ship between information gained by Eve and the disturbance observed by Alice and Bob. Our theorem provides a 
generalization of the robustness result obtained thus far. Moreover it guarantees that information gained by Eve is 
small if both of two error probabilities observed by the legitimate users are sufficiently small. Applying the inequality 
to the full protocol in order to examine its security is an important future problem. 
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